Data Processing Agreement
1. Parties and roles
This agreement is between the customer who subscribes to the Arenzo Sales Agent ("controller") and Arenzo, KvK 99169843, Fresiaplein 11, 2241 XS Wassenaar, the Netherlands ("processor"). It applies to personal data that the controller puts into the Sales Agent or that the Sales Agent finds or creates for the controller. It meets the requirements of article 28 of the General Data Protection Regulation (GDPR). It is accepted together with the Terms of Service at checkout.
2. What is processed
| Subject | Details |
|---|---|
| Purpose | Providing the Sales Agent: storing accounts and contacts, scoring and qualifying them, preparing briefs and first lines, chat, exports |
| Categories of people | Contact persons at the controller's prospects and customers; the controller's own users |
| Types of data | Business contact data (name, job title, business email, business phone, company, LinkedIn profile), notes, and public company information |
| Special categories | None. The controller does not put special category data into the service. |
| Duration | The term of the subscription plus 30 days for export, after which the data is deleted |
3. Processor obligations
3.1 Arenzo processes the personal data only on the controller's documented instructions, which are these terms and the controller's use of the service, unless EU or Dutch law requires otherwise.
3.2 Everyone at Arenzo who has access to the data is bound by confidentiality.
3.3 Arenzo takes appropriate technical and organisational measures, including invite only access, separation of workspaces through row level security, encrypted connections, access limited to staff who need it, and backups by its hosting providers.
3.4 Arenzo helps the controller, where reasonable, with requests from data subjects, with security, with data protection impact assessments and with questions from supervisory authorities.
3.5 Arenzo informs the controller without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach that affects the controller's data, with the information the controller needs to meet its own obligations.
3.6 At the end of the subscription Arenzo deletes the personal data within 30 days after the export period, unless law requires it to be kept.
3.7 Arenzo makes available the information needed to show compliance with this agreement and allows reasonable audits, at most once a year, with 30 days notice, at the controller's cost.
4. Sub processors
The controller gives general permission for these sub processors: Base44 (Wix.com group) for app hosting, sign in and email; Supabase for the database; Vercel for hosting of the scoring backend and website; AI model providers used through Base44 for generating text; Stripe for billing of the controller itself. Arenzo binds each sub processor to obligations equal to this agreement and remains responsible for them. Arenzo announces new sub processors at least 30 days in advance by email; the controller may object and, if no solution is found, cancel.
5. Transfers outside the EU
Where a sub processor processes data outside the European Economic Area, the transfer is covered by the EU US Data Privacy Framework or by the European Commission's standard contractual clauses.
6. Controller obligations
The controller makes sure it has a lawful basis for the personal data it puts into the service and for the outreach it does, informs the people concerned where required, and respects objections and opt outs.
7. Liability and law
The liability limits of the Terms of Service apply. Dutch law applies, and disputes go to the competent court in The Hague. If this agreement and the Terms of Service conflict on data protection, this agreement prevails.